{...}: {
  resource = {
    kubernetes_pod."workspace" = {
      count = "\${data.coder_workspace.me.start_count}";
      metadata = {
        name = "coder-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
        namespace = "\${var.namespace}";
        annotations."com.coder.user.email" = "\${data.coder_workspace_owner.me.email}";
        labels = {
          "app.kubernetes.io/instance" = "coder-workspace-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
          "app.kubernetes.io/name" = "coder-workspace";
          "app.kubernetes.io/part-of" = "coder";
          "com.coder.resource" = "true";
          "com.coder.user.id" = "\${data.coder_workspace_owner.me.id}";
          "com.coder.user.name" = "\${data.coder_workspace_owner.me.name}";
          "com.coder.workspace.id" = "\${data.coder_workspace.me.id}";
          "com.coder.workspace.name" = "\${data.coder_workspace.me.name}";
        };
      };
      # give the shutdown tasks enough time to run
      timeouts.delete = "31m";
      spec = {
        termination_grace_period_seconds = 1800;
        affinity.pod_anti_affinity.preferred_during_scheduling_ignored_during_execution = {
          weight = 1;
          pod_affinity_term = {
            topology_key = "kubernetes.io/hostname";
            label_selector.match_expressions = {
              key = "app.kubernetes.io/name";
              operator = "In";
              values = ["coder-workspace"];
            };
          };
        };
        init_container = [
          {
            name = "chown";
            image = "alpine:3";
            command = ["chown" "1000:1000" "/mnt/nix" "/mnt/tmp" "/mnt/home"];
            security_context.run_as_user = "0";
            volume_mount = [
              {
                mount_path = "/mnt/home";
                name = "home";
                read_only = false;
              }
              {
                mount_path = "/mnt/nix";
                name = "nix-store";
                read_only = false;
              }
              {
                mount_path = "/mnt/tmp";
                name = "tmp";
                read_only = false;
              }
            ];
          }
          {
            name = "copy-nix-store";
            image = "registry.gitlab.com/technofab/coder-templates/nix-coder-image:\${data.coder_parameter.image_tag.value}";
            command = ["cp" "-nR" "/nix/." "/pv_nix"];
            security_context.run_as_user = "1000";
            volume_mount = [
              {
                mount_path = "/pv_nix";
                name = "nix-store";
                read_only = false;
              }
            ];
          }
        ];
        container = [
          {
            name = "workspace";
            image = "registry.gitlab.com/technofab/coder-templates/nix-coder-image:\${data.coder_parameter.image_tag.value}";
            command = ["/bin/sh" "-c" "\${resource.coder_agent.coder.init_script}"];
            env = [
              {
                name = "CODER_AGENT_TOKEN";
                value = "\${resource.coder_agent.coder.token}";
              }
              {
                name = "DOTFILES_REPO";
                value = "\${data.coder_parameter.dotfiles_repo.value}";
              }
              {
                name = "TZ";
                value = "\${data.coder_parameter.timezone.value}";
              }
              {
                name = "NIX_CONFIG";
                value = "\${data.coder_parameter.nix_config.value}";
              }
            ];
            resources = {
              requests = {
                cpu = "\${var.cpu_request}";
                memory = "\${var.memory_request}";
              };
              limits = {
                cpu = "\${data.coder_parameter.cpu.value}";
                memory = "\${data.coder_parameter.memory.value}";
              };
            };
            security_context = {
              run_as_user = 1000;
              run_as_group = 1000;
            };
            volume_mount = [
              {
                mount_path = "/home";
                name = "home";
                read_only = false;
              }
              {
                mount_path = "/nix";
                name = "nix-store";
                read_only = false;
              }
              {
                mount_path = "/tmp";
                name = "tmp";
                read_only = false;
              }
            ];
          }
        ];
        security_context = {
          run_as_user = 1000;
          run_as_group = 1000;
        };
        volume = [
          {
            name = "home";
            persistent_volume_claim.claim_name = "\${resource.kubernetes_persistent_volume_claim.home.metadata.0.name}";
          }
          {
            name = "nix-store";
            persistent_volume_claim.claim_name = "\${resource.kubernetes_persistent_volume_claim.nix-store.metadata.0.name}";
          }
          {
            name = "tmp";
            empty_dir = {
              medium = "Memory";
              # not used for now
              # sizeLimit = "200Mi";
            };
          }
        ];
      };
    };
    kubernetes_persistent_volume_claim."home" = {
      metadata = {
        name = "coder-home-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
        namespace = "\${var.namespace}";
        annotations."com.coder.user.email" = "\${data.coder_workspace_owner.me.email}";
        labels = {
          "app.kubernetes.io/instance" = "coder-pvc-home-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
          "app.kubernetes.io/name" = "coder-pvc";
          "app.kubernetes.io/part-of" = "coder";
          "com.coder.resource" = "true";
          "com.coder.user.id" = "\${data.coder_workspace_owner.me.id}";
          "com.coder.user.name" = "\${data.coder_workspace_owner.me.name}";
          "com.coder.workspace.id" = "\${data.coder_workspace.me.id}";
          "com.coder.workspace.name" = "\${data.coder_workspace.me.name}";
        };
      };
      spec = {
        access_modes = ["ReadWriteOnce"];
        resources.requests.storage = "\${data.coder_parameter.home_disk_size.value}Gi";
      };
      wait_until_bound = false;
    };
    kubernetes_persistent_volume_claim."nix-store" = {
      metadata = {
        name = "coder-nix-store-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
        namespace = "\${var.namespace}";
        annotations."com.coder.user.email" = "\${data.coder_workspace_owner.me.email}";
        labels = {
          "app.kubernetes.io/instance" = "coder-pvc-nix-store-\${lower(data.coder_workspace_owner.me.name)}-\${lower(data.coder_workspace.me.name)}";
          "app.kubernetes.io/name" = "coder-pvc";
          "app.kubernetes.io/part-of" = "coder";
          "com.coder.resource" = "true";
          "com.coder.user.id" = "\${data.coder_workspace_owner.me.id}";
          "com.coder.user.name" = "\${data.coder_workspace_owner.me.name}";
          "com.coder.workspace.id" = "\${data.coder_workspace.me.id}";
          "com.coder.workspace.name" = "\${data.coder_workspace.me.name}";
        };
      };
      spec = {
        access_modes = ["ReadWriteOnce"];
        resources.requests.storage = "\${data.coder_parameter.nix_store_disk_size.value}Gi";
      };
      wait_until_bound = false;
    };
  };
}